{
  "tool_id": "art-517-audit-trail-completeness",
  "note": "Vectors computed directly from the shipped kernel. Covers CONTINUOUS, a known sequence gap matching the row example (position 1003), a hash-chain gap, the control_total MECHANISM_INSUFFICIENT case (deliberately distinct from GAP_DETECTED -- a period-level break the mechanism cannot localize to one event), privileged-action-uncovered plus retention-short combined flags, the section 6.9 region-portability second-jurisdiction case (same kernel, EU DORA style declared inputs, no code change), and the empty-input edge case.",
  "vectors": [
    {
      "name": "sequence-continuous-jurisdiction-a",
      "policy_parameters": {
        "window_start": "2026-07-01T00:00:00Z",
        "window_end": "2026-07-01T23:59:59Z",
        "continuity_mechanism": "sequence_number",
        "sequence_start": 1000,
        "sequence_end": 1010,
        "observed_sequence_numbers": [
          1000,
          1001,
          1002,
          1003,
          1004,
          1005,
          1006,
          1007,
          1008,
          1009,
          1010
        ],
        "observed_event_counts_by_type": {
          "transaction": 850,
          "user_activity": 140,
          "privileged_action": 12
        },
        "declared_retention_period_days": 120,
        "required_retention_period_days": 90,
        "gap_candidates": []
      },
      "output_payload": {
        "continuity_verdict": "CONTINUOUS",
        "window_start": "2026-07-01T00:00:00Z",
        "window_end": "2026-07-01T23:59:59Z",
        "continuity_mechanism": "sequence_number",
        "gaps": [],
        "gap_count": 0,
        "undecidable": [],
        "event_counts_by_type": {
          "transaction": 850,
          "user_activity": 140,
          "privileged_action": 12
        },
        "privileged_action_coverage": {
          "transaction_events_logged": 850,
          "privileged_events_logged": 12,
          "covered": true
        },
        "retention_conformance": {
          "declared_days": 120,
          "required_days": 90,
          "conforms": true
        },
        "known_gap_candidates_reconciled": [],
        "regulatory_basis": "RFP CDGPSS202601 §4.5 (audit trails for transactions and user activities, generalised); portable to any regime declaring an audit-trail continuity and retention duty (e.g. EU DORA Art 15 / RTS ICT-related incident record-keeping) via caller-supplied inputs only",
        "table_version": "AUDIT-TRAIL-COMPLETENESS-2026"
      },
      "compliance_flags": [
        "TRAIL_CONTINUOUS"
      ],
      "golden_hash": "6b0e23109fb3ad11f178b764f6dd110216cb7ae3beb2c2240291b1e638d7191b"
    },
    {
      "name": "sequence-known-gap-and-privileged-uncovered",
      "policy_parameters": {
        "window_start": "2026-07-01T00:00:00Z",
        "window_end": "2026-07-01T23:59:59Z",
        "continuity_mechanism": "sequence_number",
        "sequence_start": 1000,
        "sequence_end": 1010,
        "observed_sequence_numbers": [
          1000,
          1001,
          1002,
          1004,
          1005,
          1006,
          1007,
          1008,
          1009,
          1010
        ],
        "observed_event_counts_by_type": {
          "transaction": 500,
          "user_activity": 80,
          "privileged_action": 0
        },
        "declared_retention_period_days": 30,
        "required_retention_period_days": 90,
        "gap_candidates": [
          {
            "position": 1003
          }
        ]
      },
      "output_payload": {
        "continuity_verdict": "GAP_DETECTED",
        "window_start": "2026-07-01T00:00:00Z",
        "window_end": "2026-07-01T23:59:59Z",
        "continuity_mechanism": "sequence_number",
        "gaps": [
          {
            "position": 1003,
            "mechanism": "sequence_number",
            "detail": "sequence number not observed"
          }
        ],
        "gap_count": 1,
        "undecidable": [],
        "event_counts_by_type": {
          "transaction": 500,
          "user_activity": 80,
          "privileged_action": 0
        },
        "privileged_action_coverage": {
          "transaction_events_logged": 500,
          "privileged_events_logged": 0,
          "covered": false
        },
        "retention_conformance": {
          "declared_days": 30,
          "required_days": 90,
          "conforms": false
        },
        "known_gap_candidates_reconciled": [
          {
            "position": "1003",
            "detected": true
          }
        ],
        "regulatory_basis": "RFP CDGPSS202601 §4.5 (audit trails for transactions and user activities, generalised); portable to any regime declaring an audit-trail continuity and retention duty (e.g. EU DORA Art 15 / RTS ICT-related incident record-keeping) via caller-supplied inputs only",
        "table_version": "AUDIT-TRAIL-COMPLETENESS-2026"
      },
      "compliance_flags": [
        "TRAIL_GAP_DETECTED",
        "TRAIL_PRIVILEGED_UNCOVERED",
        "TRAIL_RETENTION_SHORT"
      ],
      "golden_hash": "a98a110d470c1ce1543edf67b00ebd144152b060ba11d248f302f4e605d570fb"
    },
    {
      "name": "hash-chain-gap-detected",
      "policy_parameters": {
        "window_start": "2026-07-02T00:00:00Z",
        "window_end": "2026-07-02T23:59:59Z",
        "continuity_mechanism": "hash_chain",
        "chain_links": [
          {
            "position": 1,
            "sha256_prev_record": "",
            "sha256_this_record": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          {
            "position": 2,
            "sha256_prev_record": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "sha256_this_record": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
          },
          {
            "position": 4,
            "sha256_prev_record": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
            "sha256_this_record": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
          }
        ],
        "observed_event_counts_by_type": {
          "transaction": 60,
          "user_activity": 9,
          "privileged_action": 3
        },
        "declared_retention_period_days": 120,
        "required_retention_period_days": 90
      },
      "output_payload": {
        "continuity_verdict": "GAP_DETECTED",
        "window_start": "2026-07-02T00:00:00Z",
        "window_end": "2026-07-02T23:59:59Z",
        "continuity_mechanism": "hash_chain",
        "gaps": [
          {
            "position": 3,
            "mechanism": "hash_chain",
            "detail": "sequence break between chained positions"
          },
          {
            "position": 4,
            "mechanism": "hash_chain",
            "detail": "sha256_prev_record does not match prior link sha256_this_record"
          }
        ],
        "gap_count": 2,
        "undecidable": [],
        "event_counts_by_type": {
          "transaction": 60,
          "user_activity": 9,
          "privileged_action": 3
        },
        "privileged_action_coverage": {
          "transaction_events_logged": 60,
          "privileged_events_logged": 3,
          "covered": true
        },
        "retention_conformance": {
          "declared_days": 120,
          "required_days": 90,
          "conforms": true
        },
        "known_gap_candidates_reconciled": [],
        "regulatory_basis": "RFP CDGPSS202601 §4.5 (audit trails for transactions and user activities, generalised); portable to any regime declaring an audit-trail continuity and retention duty (e.g. EU DORA Art 15 / RTS ICT-related incident record-keeping) via caller-supplied inputs only",
        "table_version": "AUDIT-TRAIL-COMPLETENESS-2026"
      },
      "compliance_flags": [
        "TRAIL_GAP_DETECTED"
      ],
      "golden_hash": "5e8c4f17b726b512a293c42d9a52a82af73ba43fa41dd6bf3b65406f5dba37a7"
    },
    {
      "name": "control-total-mechanism-insufficient-retention-short",
      "policy_parameters": {
        "window_start": "2026-07-03T00:00:00Z",
        "window_end": "2026-07-03T23:59:59Z",
        "continuity_mechanism": "control_total",
        "periods": [
          {
            "period_id": "2026-07-03",
            "declared_event_count": 1000,
            "reported_event_count": 994
          }
        ],
        "observed_event_counts_by_type": {
          "transaction": 994,
          "user_activity": 120,
          "privileged_action": 4
        },
        "declared_retention_period_days": 60,
        "required_retention_period_days": 90
      },
      "output_payload": {
        "continuity_verdict": "MECHANISM_INSUFFICIENT",
        "window_start": "2026-07-03T00:00:00Z",
        "window_end": "2026-07-03T23:59:59Z",
        "continuity_mechanism": "control_total",
        "gaps": [
          {
            "position": "2026-07-03",
            "mechanism": "control_total",
            "detail": "control total mismatch: declared 1000 vs reported 994"
          }
        ],
        "gap_count": 1,
        "undecidable": [
          {
            "period_id": "2026-07-03",
            "reason": "control total localizes the period, not the individual missing event"
          }
        ],
        "event_counts_by_type": {
          "transaction": 994,
          "user_activity": 120,
          "privileged_action": 4
        },
        "privileged_action_coverage": {
          "transaction_events_logged": 994,
          "privileged_events_logged": 4,
          "covered": true
        },
        "retention_conformance": {
          "declared_days": 60,
          "required_days": 90,
          "conforms": false
        },
        "known_gap_candidates_reconciled": [],
        "regulatory_basis": "RFP CDGPSS202601 §4.5 (audit trails for transactions and user activities, generalised); portable to any regime declaring an audit-trail continuity and retention duty (e.g. EU DORA Art 15 / RTS ICT-related incident record-keeping) via caller-supplied inputs only",
        "table_version": "AUDIT-TRAIL-COMPLETENESS-2026"
      },
      "compliance_flags": [
        "TRAIL_MECHANISM_INSUFFICIENT",
        "TRAIL_RETENTION_SHORT"
      ],
      "golden_hash": "9af48c298221dddfb656608ca9e1d046fe7e90b6b013812c991f8fbdefe8fb5a"
    },
    {
      "name": "region-portability-second-jurisdiction-dora",
      "policy_parameters": {
        "window_start": "2026-01-01T00:00:00Z",
        "window_end": "2026-01-07T23:59:59Z",
        "continuity_mechanism": "hash_chain",
        "chain_links": [
          {
            "position": 1,
            "sha256_prev_record": "",
            "sha256_this_record": "1111111111111111111111111111111111111111111111111111111111111111"
          },
          {
            "position": 2,
            "sha256_prev_record": "1111111111111111111111111111111111111111111111111111111111111111",
            "sha256_this_record": "2222222222222222222222222222222222222222222222222222222222222222"
          },
          {
            "position": 3,
            "sha256_prev_record": "2222222222222222222222222222222222222222222222222222222222222222",
            "sha256_this_record": "3333333333333333333333333333333333333333333333333333333333333333"
          }
        ],
        "observed_event_counts_by_type": {
          "transaction": 3000,
          "user_activity": 410,
          "privileged_action": 22
        },
        "declared_retention_period_days": 1825,
        "required_retention_period_days": 1825,
        "gap_candidates": []
      },
      "output_payload": {
        "continuity_verdict": "CONTINUOUS",
        "window_start": "2026-01-01T00:00:00Z",
        "window_end": "2026-01-07T23:59:59Z",
        "continuity_mechanism": "hash_chain",
        "gaps": [],
        "gap_count": 0,
        "undecidable": [],
        "event_counts_by_type": {
          "transaction": 3000,
          "user_activity": 410,
          "privileged_action": 22
        },
        "privileged_action_coverage": {
          "transaction_events_logged": 3000,
          "privileged_events_logged": 22,
          "covered": true
        },
        "retention_conformance": {
          "declared_days": 1825,
          "required_days": 1825,
          "conforms": true
        },
        "known_gap_candidates_reconciled": [],
        "regulatory_basis": "RFP CDGPSS202601 §4.5 (audit trails for transactions and user activities, generalised); portable to any regime declaring an audit-trail continuity and retention duty (e.g. EU DORA Art 15 / RTS ICT-related incident record-keeping) via caller-supplied inputs only",
        "table_version": "AUDIT-TRAIL-COMPLETENESS-2026"
      },
      "compliance_flags": [
        "TRAIL_CONTINUOUS"
      ],
      "golden_hash": "a71f10d9c912151ebb37a80ce46434269c2e47ace9f65cebfdaae0c9b3e6915a"
    },
    {
      "name": "empty-input-mechanism-insufficient",
      "policy_parameters": {},
      "output_payload": {
        "continuity_verdict": "MECHANISM_INSUFFICIENT",
        "window_start": null,
        "window_end": null,
        "continuity_mechanism": null,
        "gaps": [],
        "gap_count": 0,
        "undecidable": [
          {
            "reason": "window_start, window_end, or continuity_mechanism missing/invalid"
          }
        ],
        "event_counts_by_type": {},
        "privileged_action_coverage": {
          "transaction_events_logged": 0,
          "privileged_events_logged": 0,
          "covered": false
        },
        "retention_conformance": {
          "declared_days": null,
          "required_days": null,
          "conforms": false
        },
        "known_gap_candidates_reconciled": [],
        "regulatory_basis": "RFP CDGPSS202601 §4.5 (audit trails for transactions and user activities, generalised)",
        "table_version": "AUDIT-TRAIL-COMPLETENESS-2026"
      },
      "compliance_flags": [
        "TRAIL_MECHANISM_INSUFFICIENT"
      ],
      "golden_hash": "ed21cca6f4c17b0a83825a3af3ce4d5ff7a942ed3639a76cb10a000a20049896"
    }
  ]
}